off-site closed (R-833, R-834 closed; R-95 dated check; R-726 options) + OS-update spike: 11 corrected C1-C12, wrapper draft, answers; R-835..R-839

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/backlog/CLOSED-ITEMS.md

@@ -26,6 +26,15 @@
 
 ---
 
+## 2026-10-04 (day) — the off-site topic closed (hub v0.129.0, agent v0.139.0)
+
+> Evidence: `audits/backup-close-2026-10-04/`.
+
+| Row | What | Closed | Evidence |
+|---|---|---|---|
+| **R-834** | **A whole-guest restore brought back the production config (`onboot: 1`, the real drive binds).** Every route listed: the restore-test was MEASURED safe already (onboot 0, throwaway mp8/mp9, every poll); the agent's DR bring-up now REFUSES beside a live original (source guest present, a drives bind, or an unreadable config — agent v0.139.0, proven live on demo-hp); the hand route is `scripts/felhom-restore-beside.sh` (onboot 0 at restore, host binds removed, NICs down, never started, read back — proven live); provisioning restores the golden, which has no binds. **Rule kept: a restore that does not replace the box's own guest on a replaced host ends with onboot 0 and no host-path bind; DR on a replaced host keeps its binds.** No sudoers line added (the restore-test sets onboot 0 through the API; DR refuses rather than degrades). | CLOSED 2026-10-04 — FIXED agent v0.139.0 + script | `partA/`; tests `TestRunBringUp_DRRefusesBesideALiveOriginal`, `TestRestoreTest_NoHostPathBindBesideTheOriginal`, `scripts/test_felhom_restore_beside.py` |
+| **R-833** | **After a long gap the clean-up wedged at the default cap.** Hub v0.129.0: `POST /offsite/window-grant/<id>` with `max_remove=<n>` (operator login only, 1..500) raises ONE window's cap; the guard still applies in full; consumed once; the close check uses the window's own cap; operator event `offsite_window_large_grant`; a box cannot grant itself. Lab proof on a real restic 0.14.0 repo: 98 snapshots, plan 85, default cap 49 refused, raised 90 → 98 → 13, next window passes the default cap. | CLOSED 2026-10-04 — FIXED hub v0.129.0 | `partB/` (4 red-proofs, lab proof, live refusals) |
+
 ## 2026-10-04 — off-site safety finished (hub v0.128.0, controller v0.290.0, decisions 71–74)
 
 > Evidence: `audits/offsite-finish-2026-10-04/`.